WebGuard

L1-01   HTTPS Active

Site must be served over HTTPS. Checks that the submitted URL and all redirects land on https://. Plain HTTP means all traffic — including passwords — is transmitted unencrypted to any network observer.

L1-02   SSL Certificate

Attempts TLS handshake with certificate validation. Fails on expired, self-signed, hostname-mismatch, or invalid chain certificates. An invalid certificate leaves users open to man-in-the-middle interception.

L2-01   Exposed API Keys

Regex scans page source for live credential patterns: Stripe live/test keys, AWS access keys (AKIA…), GitHub tokens (ghp_…), Google API keys (AIza…), Slack tokens (xox…), Twilio, SendGrid. Any match means live credentials are visible to anyone who views source.

L2-02   HTTP Form Submission

Checks whether any HTML <form> element's action attribute points to an http:// URL. Form data — including passwords — submitted over HTTP is transmitted in cleartext.

L2-03   Directory Listing

Detects server-generated directory indexes by searching for "Index of /", "Parent Directory</a>", "directory listing for", "<title>index of" in the response body. These strings are exclusive to server-generated directory listings — not navigation links.

L2-04   Sensitive Data Exposure

Regex scans the response body for: SSN patterns (\d{3}-\d{2}-\d{4}), credit card numbers (Visa, Mastercard, Amex formats), PEM private key headers (-----BEGIN PRIVATE KEY-----), and plaintext password values in JSON responses.

L2-05   Debug / Error Exposure

Detects: active stack traces (Python Traceback, Java at …, Node.js Error), SQL error messages, debug panels (Xdebug, Django debug mode, Laravel Debugbar, Whoops!), and presence of X-Debug-Token or X-Debug-Token-Link headers.

L2-06   Admin Page Exposure

Probes 20 paths in parallel across four categories — Generic: /admin, /administrator, /manager, /manage, /backend, /console, /panel, /controlpanel, /cp, /system — WordPress: /wp-admin, /wp-login.php, /admin.php — DB tools: /phpmyadmin, /adminer — CMS/AI-app patterns: /cms, /superadmin, /portal, /moderator, /staff. HTTP 200 = instant fail — unauthenticated admin access is exploit-ready. HTTP 3xx redirects, 401, and 403 are treated as pass (auth is working). SPA detection: if all 200 responses share the same <title> as the homepage, the site uses client-side routing and is not flagged.

L2-07   JWT Algorithm None

Detects JWT tokens where the header declares alg: none — a condition that instructs the server to skip signature verification entirely. Any token can be forged and accepted as valid without a secret or private key. Authentication is fully broken. Basis: RFC 7519 §6.

L3-01   Content Security Policy

Warning: header absent; or present but script-src (or effective default-src) contains 'unsafe-inline', 'unsafe-eval', or wildcard *. 'unsafe-inline' in style-src alone is not flagged — CSS injection is lower severity and commonly required by CSS frameworks (Tailwind, etc.). Pass: CSP present with no unsafe script directives.

L3-02   X-Frame-Options

Warning: X-Frame-Options header absent AND no frame-ancestors CSP directive. Pass: DENY, SAMEORIGIN, or a frame-ancestors CSP directive is present.

L3-03   HSTS

Warning: Strict-Transport-Security header absent; or present but max-age < 31536000 (1 year). Only evaluated on HTTPS sites — on HTTP sites the result is "N/A: requires HTTPS first".

L3-04   Server Information Disclosure

Warning: Server header contains a version string in x.y format or more specific (e.g. nginx/1.24, Apache/2.4.58); or any X-Powered-By header is present. Generic server names without a version (e.g. cloudflare, nginx) are not flagged — they reveal the software family but not an exploitable version. X-Powered-By is always flagged regardless of content.

L3-05   X-Content-Type-Options

Warning: X-Content-Type-Options: nosniff absent. Without it, some browsers MIME-sniff responses and may execute uploaded files (e.g. images) as scripts.

L3-06   Referrer Policy

Warning: Referrer-Policy header absent; or set to unsafe-url or no-referrer-when-downgrade. Safe values: no-referrer, same-origin, strict-origin, strict-origin-when-cross-origin. Basis: W3C Referrer Policy specification.

L3-07   Cookie Security

Warning: a session-relevant cookie (name matches session/auth/token patterns, or has no Expires/Max-Age) lacks one or more of: HttpOnly (prevents JS access), Secure (HTTPS only), SameSite (CSRF mitigation). Non-session cookies (analytics, preferences, A/B flags) are not evaluated. Pass + advisory note: all three flags present but cookie names do not use __Host- or __Secure- prefixes — these enforce additional browser-level constraints (__Host-: requires Secure + Path=/ + no Domain attribute; __Secure-: requires Secure flag) and are a defense-in-depth recommendation per ASVS 3.4.2 L2. Basis: RFC 6265 §4.1.3.

L3-08   JWT Body Exposure

Warning: JWT token (eyJ…) found in response body. Exposed tokens may contain decodable user claims and indicate that sensitive session data is transmitted in a readable format. This check does not evaluate the algorithm — see L2-07 JWT Algorithm None for the critical instant-fail variant.

L4-01   CORS Configuration

Sends request with Origin: https://evil.example.com.
Fail: server reflects the arbitrary origin AND Access-Control-Allow-Credentials: true — enables authenticated cross-site requests (auth bypass).
Warning: server reflects the arbitrary origin without credentials — any site can read public responses; restrict if auth is involved.
Pass: Access-Control-Allow-Origin: * without credentials — acceptable for fully public APIs and CDNs. Basis: WHATWG Fetch Standard §3.2.5.

L4-02   Dangerous HTTP Methods

Sends OPTIONS request and reads Allow header. All findings are warnings — no instant-fail state.
Warning (TRACE): TRACE active — no legitimate production use; exploitable via Cross-Site Tracing (XST) to steal cookies/auth headers via JavaScript. Disable immediately.
Warning (PUT/DELETE/PATCH): elevated methods active on root URL — ensure these are restricted to authenticated endpoints. Basis: RFC 9110 §9.3.8.

L4-03   CSRF Protection

Warning: <form> elements with a state-changing method (POST, PUT, DELETE, PATCH) found, but no CSRF token field detected. GET forms and forms with no method attribute are not flagged — GET requests are not CSRF-relevant per RFC 7231. Token field names checked: _token, csrf, csrftoken, xsrf, authenticity_token, antiforgery, _csrf_token. SameSite=Strict/Lax cookies are also accepted as a valid CSRF mitigation. Basis: OWASP CSRF Prevention Cheat Sheet.